PT-2025-14387 · Ouch · Ouch

Yewan · Published 2025-04-01 · Updated 2025-04-02 · CVE-2024-13941

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions ouch-org ouch versions up to 0.3.1

Description A critical issue has been found, affecting the function ouch::archive::zip::convert zip date time of the file zip.rs. The manipulation of the argument month leads to memory corruption. The attack must be approached locally.

Recommendations Upgrading to version 0.4.0 is able to address this issue. It is recommended to upgrade the affected component.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2024-13941

GHSA-6XFJ-HHWH-R3C2

Affected Products

Ouch

References · 13

• 🔥 https://github.com/ouch-org/ouch/issues/707 · Exploit
• 🔥❌ https://github.com/user-attachments/files/16767988/ouch.crash.report.docx · Exploit, Deleted
• https://github.com/ouch-org/ouch/releases/tag/0.4.0 · Patch
• https://osv.dev/vulnerability/GHSA-6xfj-hhwh-r3c2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-13941 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-13941 · Security Note
• https://github.com/ouch-org/ouch · Note
• https://github.com/rustsec/advisory-db/pull/2084/files · Note
• https://twitter.com/CVEnew/status/1907339872710357415 · Twitter Post
• https://vuldb.com/?ctiid.302055 · Note
• https://vuldb.com/?id.302055 · Note
• https://vuldb.com/?submit.524511 · Note
• https://twitter.com/CVETracker/status/1907523618206109938 · Twitter Post